What is the CVSS score of EUVD-2026-46092?

EUVD-2026-46092 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for EUVD-2026-46092?

Yes, a patch is available for EUVD-2026-46092. Update the affected software to the latest version immediately.

FreeScout EUVD-2026-46092

| CVE-2026-53594 MEDIUM

Path Traversal (CWE-22)

2026-07-20 GitHub_M

PHP Path Traversal Freescout Freescout Help Desk

4.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Admin-level authenticated session required to reach App Logs route (PR:H); read-only file disclosure with no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 20, 2026 - 23:18 EUVD

Analysis Generated

Jul 20, 2026 - 20:46 vuln.today

DescriptionCVE.org

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage -> Logs -> App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior to version 1.8.224, the path resolution logic accepts any existing absolute path before applying the intended storage/logs restriction. As a result, an attacker who can access the App Logs route and forge a valid Laravel-encrypted dl parameter can download arbitrary server-local files readable by the PHP process, not just log files. Version 1.8.224 contains a fix.

AnalysisAI

Arbitrary file read via path traversal in FreeScout's App Logs feature exposes any server-local file readable by the PHP process to authenticated administrators prior to version 1.8.224. The bundled rap2hpoutre/laravel-log-viewer override decrypts a user-supplied dl parameter and resolves its absolute path before applying the intended storage/logs directory restriction, allowing the restriction to be bypassed entirely. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, successful exploitation could expose sensitive server files such as environment credentials or application secrets.

Technical ContextAI

FreeScout is a PHP application built on the Laravel framework, functioning as a self-hosted help desk and shared inbox. The affected component is the Manage -> Logs -> App Logs feature, which uses a bundled override of the rap2hpoutre/laravel-log-viewer package. The dl query parameter is decrypted using Laravel's symmetric encryption (requiring knowledge of or a valid session using the application key), and the resulting value is resolved to an absolute filesystem path. The flaw (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) arises because the path traversal guard checking for the storage/logs prefix is applied after path resolution rather than before, meaning any valid absolute path accessible to the PHP process can be served as a file download. The affected CPE is cpe:2.3:a:freescout-help-desk:freescout:*:*:*:*:*:*:*:* covering all versions prior to 1.8.224.

RemediationAI

Upgrade FreeScout to version 1.8.224, which contains the fix as confirmed by GitHub Security Advisory GHSA-858x-8f77-9vc5 (https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-858x-8f77-9vc5). If an immediate upgrade is not possible, restrict access to the App Logs route (Manage -> Logs -> App Logs) via web server ACLs or application-level role restrictions to the smallest possible set of trusted administrators - this reduces the attack surface but does not eliminate the vulnerability for those who retain access. Additionally, ensure the PHP process runs under a dedicated low-privilege user account with filesystem permissions scoped to only the directories the application legitimately requires, which limits the files an attacker could retrieve even if exploitation occurs. No other workarounds are described in the available advisory.